1

I want to use a strong authentication scheme, so I decided to use PBKDF2. I'm using PBKDF2 with SHA256 algorithm, 5000 iterations and I use username (which is full email address of user) as salt. So every user have a unique email, their email address is their identifier. So when they enter password, I'll use PBKDF2 with 5000 iteration and SHA256 algorithm to hash user's password.

Do you think it's good? Can you tell me if there is any security weakness on this hashing scheme?

Improve this question

1 Answer 1

Reset to default
2

Yes, there's a weakness. You should change the salt every time the user changes the password, and you cannot do that with your scheme. An attacker who knows what the salt must be can mount a pre-computation attack, computing hashes for thousands of passwords. Then, even if a user changes the password, the attacker probably already has it pre-computed.

The salt should come from a cryptographically secure pseudo-random number generator (CSPRNG).

Improve this answer
9
  • Thank you for being clear, I understood. Can you point out some good CSPRNG algorithms?
    – JustACPPFan
    Commented Jan 11, 2015 at 0:17
  • It depends on the language. Try Google for something like "CSPRNG PHP" or "CSPRNG Java".
    – Bob Brown
    Commented Jan 11, 2015 at 0:18
  • 1
    Thank you, I'll accept answer after 10 min limit (it doesn't allow me to accept before that)
    – JustACPPFan
    Commented Jan 11, 2015 at 0:19
  • 1
    /dev/urandom on Linux/OSX, CryptGenRandom() on Windows.
    – Stephen Touset
    Commented Jan 11, 2015 at 0:34
  • 1
    Absolutely do not attempt to cobble together a zero-knowledge password protocol by yourself. If you must, use something like SRP, and use a preexisting implementation; it is, as I understand it, notoriously difficult to implement without unintentionally leaking information (for instance, through timing attacks).
    – Stephen Touset
    Commented Jan 12, 2015 at 19:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .